6 ms·

Completely agree that they should turn their focus towards solving privacy and identity management. I'm hoping that this might mean they can direct some resour

Completely agree that they should turn their focus towards solving privacy and identity management. I'm hoping that this might mean they can direct some resources towards Persona development again. Or at least experiment with something new in this area.

seanp2k2 11y ago
+1 for Persona. Previous discussion: https://news.ycombinator.com/item?id=10436123 https://news.ycombinator.com/item?id=10436123 Re: privacy / security, I really wish they hadn't dropped Thunderbird.
- wamatt 11y ago
  It's a shame really, but as an outsider, it wasn't clear that Persona was even given a chance to fail.
  - StavrosK 11y ago
    That's my impression as well. A friend and I created a pastebin as a fun weekend project this weekend (https://www.pastery.net/ https://www.pastery.net/) and we used Persona for auth, since it's so damn convenient. The only problem is that it loads a bunch of files on every request, and my questions about lazy-loading went unanswered. I really wish Mozilla would change their mind and start developing this again. It feels like they expected all major websites to support it on the first year, and, when that didn't happen, they decided to drop it.
    - click170 11y ago
      With Thunderbird at least, the repo is open and available. Does the same stand for Persona? Perhaps instead of asking Firefox to do the legwork we should be contributing some of our own time to the projects we want to see succeed.
      - StavrosK 11y ago
        How is that relevant? Are you saying that Persona failed because they didn't get enough pull requests from other users?
        citruspi 11y ago
        I think they're saying that even if Mozilla may not decide to actively develop Persona anymore, Persona users and fans would be able to contribute to and further develop the project if the repo is "open and available."
        StavrosK 11y ago
        That's not happening, unfortunately. Sometimes you need someone with weight to throw around, or with technical knowledge, or both.
        click170 11y ago
        I agree sometimes it takes someone with weight to throw around, but are you saying that person needs to be a Mozilla employee? Because I wouldn't agree with that.
        StavrosK 11y ago
        No, it needs to be Mozilla itself.
      - citruspi 11y ago
        It does - https://github.com/mozilla/persona https://github.com/mozilla/persona
    - DHowett 11y ago
      Incidentally, I launched a pastebin (https://ghostbin.com/ https://ghostbin.com/) some time ago, used Persona for authentication, and absolutely loved it. Pastery looks awesome. It appears that you're using Pygments server-side?
      - rsync 11y ago
        Serious question for you and your parent: Why would a pastebin site need auth/login/userids ? All I can think of is editing pastes, but isn't it easier to just create a new (anonymous) paste instead of editing ?
        lotyrin 11y ago
        Deletion. Modification of pastes and maintaining the same id (URL). Though, these can be solved with tokens per post, it's tough to remember/maintain multiple tokens, doesn't work out in practice.
        DHowett 11y ago
        They're primarily for content ownership management. I'd prefer not to have accounts, and Ghostbin tries to avoid keeping identifiable information around, but they do come in fairly handy for maintaining control of the things you've pasted and the right to revoke them. Session cookies aren't quite up to the task, since they can't stick around forever and are difficult to bring with you between workspaces. (edit to elaborate on "avoid keeping identifiable information": account names are hashed, the account never stores user identification, and a paste doesn't track which account created it. For most intents and many purposes, the creator of a paste is anonymous. We could get into drawing correlations between all the pastes owned by an account, but I'm not particularly interested in sitting around and doing that.)
        r-w 11y ago
        Preventing inundation with pastes. This is less of a problem for a small project like this compared to one of the major sites, whose server architecture is probably more robust.
      - StavrosK 11y ago
  - nickbauman 11y ago
    Absolutely right. Dan Callahan's statement on why: "with Mozilla Labs somewhat sudden dissolution, we were unexpectedly asked to demonstrate traction and commercial adoption that simply wasn't there." Commercial adoption? What does that even mean in the context of MoCo? What does MoCo sell? And 24 months? Makes no sense, even for MoCo. Google is consistently a small player in the Cloud Computing Platform space. Their response: "we're not going away." MoCo has scores of millions in the bank. I'm still baffled.
    - derefr 11y ago
      I think that for Persona in particular, "commercial adoption" would probably have meant "random startups deploying Persona as their customers' identity provider." The idea being that a government/nonprofit/enterprise can be convinced to adopt any old ridiculous thing if you say the right things about it, but "the market" (i.e. a critical mass of SMBs) will only adopt your product if it's giving them a higher ROI than the alternative.
      - nickbauman 11y ago
        Yeah I don't buy that either. Was there an ROI case made about the iPhone? I don't think so. There's no similar ROI case anyone could make for Firefox, either.
        derefr 11y ago
        The original iPhone wasn't a platform (didn't have "apps"), remember; it had value without third party support. Persona, meanwhile, has no value apart from its adoption. Obviously, it doesn't need adoption to "survive", but it does need adoption to succeed in its goals: rescuing users from stupid hack-job login systems. I would compare it more to Chrome: Google made Chrome with the goal of getting the web to work better for some people, so they could more easily consume Google's various services. You could say that Chrome's bottom line was "increased Google service adoption": if Chrome renders faster and provides more HTML5 features, then Google gets more and happier customers for their products. Mozilla doesn't have "services" that Persona is a loss-leader for, but there's still that same ROI calculation of whether Persona is achieving its goals, and measuring adoption rate is a good proxy for that. The important thing, that Mozilla failed to do, was to actually understand what an adoption curve for something like Persona should look like, and what things affect it. They needed to heavily advertise it (to developers, not to users!) over about two years, and then start looking at the adoption curve.
nextos 11y ago
I really agree on this. They should focus on a browser that respects privacy and email that respects privacy (perhaps by resuming Thunderbird development). On top of that, I'd argue IM + video/audio chat that respects privacy is something that desperately needs better solutions. I'd push software forward, and then innovate on protocols. Peer to peer might be the only way to achieve true privacy.
- scrollaway 11y ago
  They're trying something with Firefox Hello. Unfortunately, short of Google open sourcing Hangouts and making it a truly open protocol, I don't see a change happening in the IM space any time soon =/
  - ianlevesque 11y ago
    I think that's a little overly pessimistic. Look how quickly Slack went from non-existent to huge in the messaging space.
    - loudmax 11y ago
      Isn't Slack just another proprietary platform? They may leverage some open protocols, but I don't see how Slack decentralizes messaging. Am I missing something?
      - ianlevesque 11y ago
        It doesn't, the point is there's still room for this space to be disrupted.
- lewisl9029 11y ago
  Absolutely. Although the market for centralized secure messaging is currently being served adequately by the likes of Signal and Telegram, centralized messaging platforms inevitably leak metadata. I don't want to belittle the work done by teams that have already started work on distributed messaging platforms like Tox and Matrix (and my own proof-of-concept, Toc [1]), but Mozilla is in a much better position to tackle the problem of decentralized, private messaging that also has great UX, and not just in terms of sheer resources: 1) They have (or at least had) a decentralized identity management platform in Persona. 2) They have a decentralized, zero-knowledge data sync platform in Firefox Sync. 3) They have a lot of influence in the web standards community that they can leverage to push a new federated messaging protocol to succeed XMPP. This is the kind of work that I think Mozilla should be doing, because they can do it better than anyone else who's willing (i.e. not for-profit corporations, because they have very little to gain by building decentralized apps and federated protocols that have no lock-in whatsoever). [1] http://toc.im/ http://toc.im/
gsnedders 11y ago
The problem is solving privacy and identity management in the mobile space is hard given how vertically integrated both the iOS and Android eco-systems by Apple and Google respectively. Firefox (and Opera) had failed to make any headway into Android in the years prior.

seanp2k2 11y ago

+1 for Persona. Previous discussion: https://news.ycombinator.com/item?id=10436123 https://news.ycombinator.com/item?id=10436123 Re: privacy / security, I really wish they hadn't dropped Thunderbird.

wamatt 11y ago
It's a shame really, but as an outsider, it wasn't clear that Persona was even given a chance to fail.
- StavrosK 11y ago
  That's my impression as well. A friend and I created a pastebin as a fun weekend project this weekend (https://www.pastery.net/ https://www.pastery.net/) and we used Persona for auth, since it's so damn convenient. The only problem is that it loads a bunch of files on every request, and my questions about lazy-loading went unanswered. I really wish Mozilla would change their mind and start developing this again. It feels like they expected all major websites to support it on the first year, and, when that didn't happen, they decided to drop it.
  - click170 11y ago
    With Thunderbird at least, the repo is open and available. Does the same stand for Persona? Perhaps instead of asking Firefox to do the legwork we should be contributing some of our own time to the projects we want to see succeed.
    - StavrosK 11y ago
      How is that relevant? Are you saying that Persona failed because they didn't get enough pull requests from other users?
      - citruspi 11y ago
        I think they're saying that even if Mozilla may not decide to actively develop Persona anymore, Persona users and fans would be able to contribute to and further develop the project if the repo is "open and available."
        StavrosK 11y ago
        That's not happening, unfortunately. Sometimes you need someone with weight to throw around, or with technical knowledge, or both.
        click170 11y ago
        I agree sometimes it takes someone with weight to throw around, but are you saying that person needs to be a Mozilla employee? Because I wouldn't agree with that.
        StavrosK 11y ago
        No, it needs to be Mozilla itself.
    - citruspi 11y ago
      It does - https://github.com/mozilla/persona https://github.com/mozilla/persona
  - DHowett 11y ago
    Incidentally, I launched a pastebin (https://ghostbin.com/ https://ghostbin.com/) some time ago, used Persona for authentication, and absolutely loved it. Pastery looks awesome. It appears that you're using Pygments server-side?
    - rsync 11y ago
      Serious question for you and your parent: Why would a pastebin site need auth/login/userids ? All I can think of is editing pastes, but isn't it easier to just create a new (anonymous) paste instead of editing ?
      - lotyrin 11y ago
        Deletion. Modification of pastes and maintaining the same id (URL). Though, these can be solved with tokens per post, it's tough to remember/maintain multiple tokens, doesn't work out in practice.
      - DHowett 11y ago
        They're primarily for content ownership management. I'd prefer not to have accounts, and Ghostbin tries to avoid keeping identifiable information around, but they do come in fairly handy for maintaining control of the things you've pasted and the right to revoke them. Session cookies aren't quite up to the task, since they can't stick around forever and are difficult to bring with you between workspaces. (edit to elaborate on "avoid keeping identifiable information": account names are hashed, the account never stores user identification, and a paste doesn't track which account created it. For most intents and many purposes, the creator of a paste is anonymous. We could get into drawing correlations between all the pastes owned by an account, but I'm not particularly interested in sitting around and doing that.)
      - r-w 11y ago
        Preventing inundation with pastes. This is less of a problem for a small project like this compared to one of the major sites, whose server architecture is probably more robust.
    - StavrosK 11y ago
- nickbauman 11y ago
  Absolutely right. Dan Callahan's statement on why: "with Mozilla Labs somewhat sudden dissolution, we were unexpectedly asked to demonstrate traction and commercial adoption that simply wasn't there." Commercial adoption? What does that even mean in the context of MoCo? What does MoCo sell? And 24 months? Makes no sense, even for MoCo. Google is consistently a small player in the Cloud Computing Platform space. Their response: "we're not going away." MoCo has scores of millions in the bank. I'm still baffled.
  - derefr 11y ago
    I think that for Persona in particular, "commercial adoption" would probably have meant "random startups deploying Persona as their customers' identity provider." The idea being that a government/nonprofit/enterprise can be convinced to adopt any old ridiculous thing if you say the right things about it, but "the market" (i.e. a critical mass of SMBs) will only adopt your product if it's giving them a higher ROI than the alternative.
    - nickbauman 11y ago
      Yeah I don't buy that either. Was there an ROI case made about the iPhone? I don't think so. There's no similar ROI case anyone could make for Firefox, either.
      - derefr 11y ago
        The original iPhone wasn't a platform (didn't have "apps"), remember; it had value without third party support. Persona, meanwhile, has no value apart from its adoption. Obviously, it doesn't need adoption to "survive", but it does need adoption to succeed in its goals: rescuing users from stupid hack-job login systems. I would compare it more to Chrome: Google made Chrome with the goal of getting the web to work better for some people, so they could more easily consume Google's various services. You could say that Chrome's bottom line was "increased Google service adoption": if Chrome renders faster and provides more HTML5 features, then Google gets more and happier customers for their products. Mozilla doesn't have "services" that Persona is a loss-leader for, but there's still that same ROI calculation of whether Persona is achieving its goals, and measuring adoption rate is a good proxy for that. The important thing, that Mozilla failed to do, was to actually understand what an adoption curve for something like Persona should look like, and what things affect it. They needed to heavily advertise it (to developers, not to users!) over about two years, and then start looking at the adoption curve.

nextos 11y ago

I really agree on this. They should focus on a browser that respects privacy and email that respects privacy (perhaps by resuming Thunderbird development). On top of that, I'd argue IM + video/audio chat that respects privacy is something that desperately needs better solutions. I'd push software forward, and then innovate on protocols. Peer to peer might be the only way to achieve true privacy.

scrollaway 11y ago
They're trying something with Firefox Hello. Unfortunately, short of Google open sourcing Hangouts and making it a truly open protocol, I don't see a change happening in the IM space any time soon =/
- ianlevesque 11y ago
  I think that's a little overly pessimistic. Look how quickly Slack went from non-existent to huge in the messaging space.
  - loudmax 11y ago
    Isn't Slack just another proprietary platform? They may leverage some open protocols, but I don't see how Slack decentralizes messaging. Am I missing something?
    - ianlevesque 11y ago
      It doesn't, the point is there's still room for this space to be disrupted.
lewisl9029 11y ago
Absolutely. Although the market for centralized secure messaging is currently being served adequately by the likes of Signal and Telegram, centralized messaging platforms inevitably leak metadata. I don't want to belittle the work done by teams that have already started work on distributed messaging platforms like Tox and Matrix (and my own proof-of-concept, Toc [1]), but Mozilla is in a much better position to tackle the problem of decentralized, private messaging that also has great UX, and not just in terms of sheer resources: 1) They have (or at least had) a decentralized identity management platform in Persona. 2) They have a decentralized, zero-knowledge data sync platform in Firefox Sync. 3) They have a lot of influence in the web standards community that they can leverage to push a new federated messaging protocol to succeed XMPP. This is the kind of work that I think Mozilla should be doing, because they can do it better than anyone else who's willing (i.e. not for-profit corporations, because they have very little to gain by building decentralized apps and federated protocols that have no lock-in whatsoever). [1] http://toc.im/ http://toc.im/

gsnedders 11y ago

The problem is solving privacy and identity management in the mobile space is hard given how vertically integrated both the iOS and Android eco-systems by Apple and Google respectively. Firefox (and Opera) had failed to make any headway into Android in the years prior.